Search for packages
| purl | pkg:npm/url-parse@1.5.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-91bh-dzjq-xbev
Aliases: CVE-2022-0686 GHSA-hgjh-723h-mx2j |
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8. |
Affected by 1 other vulnerability. |
|
VCID-c1dy-p3tz-dbcs
Aliases: CVE-2022-0691 GHSA-jf5r-8hm2-f872 |
url-parse incorrectly parses hostname / protocol due to unstripped leading control characters. Leading control characters in a URL are not stripped when passed into url-parse. This can cause input URLs to be mistakenly be interpreted as a relative URL without a hostname and protocol, while the WHATWG URL parser will trim control characters and treat it as an absolute URL. If url-parse is used in security decisions involving the hostname / protocol, and the input URL is used in a client which uses the WHATWG URL parser, the decision may be incorrect. This can also lead to a cross-site scripting (XSS) vulnerability if url-parse is used to check for the javascript: protocol in URLs. See following example: ```js const parse = require('url-parse') const express = require('express') const app = express() const port = 3000 url = parse(\"\\bjavascript:alert(1)\") console.log(url) app.get('/', (req, res) => { if (url.protocol !== \"javascript:\") {res.send(\"<a href=\\'\" + url.href + \"\\'>CLICK ME!</a>\")} }) app.listen(port, () => { console.log(`Example app listening on port ${port}`) }) ``` |
Affected by 0 other vulnerabilities. |
|
VCID-rxnd-sf2e-aqcg
Aliases: CVE-2022-0512 GHSA-rqff-837h-mm52 |
Authorization bypass in url-parse Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6. |
Affected by 3 other vulnerabilities. |
|
VCID-yqx2-x5zq-7qhv
Aliases: CVE-2022-0639 GHSA-8v38-pw62-9cw2 |
url-parse Incorrectly parses URLs that include an '@' A specially crafted URL with an '@' sign but empty user info and no hostname, when parsed with url-parse, url-parse will return the incorrect href. In particular, ```js parse(\"http://@/127.0.0.1\") ``` Will return: ```yaml { slashes: true, protocol: 'http:', hash: '', query: '', pathname: '/127.0.0.1', auth: '', host: '', port: '', hostname: '', password: '', username: '', origin: 'null', href: 'http:///127.0.0.1' } ``` If the 'hostname' or 'origin' attributes of the output from url-parse are used in security decisions and the final 'href' attribute of the output is then used to make a request, the decision may be incorrect. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-ukj6-rn9c-b7ap | Open redirect in url-parse Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior. |
CVE-2021-3664
GHSA-hh27-ffr2-f2jc |